Oracle Business Intelligence Enterprise Edition CVE-2026-71098

The attacker must have a valid low-privileged OS account with local logon capability on the specific server infrastructure where Oracle Business Intelligence Enterprise Edition 26.01.0.0.0 is executing (AV:L, PR:L). High attack complexity (AC:H) further constrains exploitation: reliable exploitation requires meeting conditions beyond the attacker's direct control, such as a race condition, specific system state, or particular configuration alignment within the Platform Security component. Remote exploitation is not possible per the CVSS vector. Exploitation is limited by: requirement for prior local access to the OBIEE host (significantly restricts attacker population), high attack complexity reducing reliability, no user interaction requirement (UI:N does not expand the attack surface here). The absence of a specific CWE means the exact prerequisite configuration within Platform Security cannot be precisely enumerated from available data.

Real-world risk is moderate-to-significant despite the local attack vector. CVSS 7.0 reflects the high-impact triad (C:H/I:H/A:H) tempered by local access requirement (AV:L) and high complexity (AC:H). EPSS data is not provided in the available intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, and no POC has been identified - both meaningful risk-reduction signals. The local-only attack vector substantially limits the attacker population: exploitation requires an existing foothold on the OBIEE host, which is typically a dedicated analytics server with restricted SSH/RDP access. The high complexity rating means reliable exploitation likely requires race conditions, specific timing, or environmental prerequisites. Even a well-resourced internal threat actor would face non-trivial barriers. The combination of AV:L, AC:H, and absence of KEV/POC suggests this is not an imminent mass-exploitation target, though the full-takeover impact means any organization running version 26.01.0.0.0 should prioritize the Oracle CPU patch in their next maintenance cycle.

An attacker who has already obtained a low-privileged shell on the server hosting Oracle Business Intelligence Enterprise Edition - through credential theft, lateral movement, or a separate initial access vulnerability - exploits a flaw in the Platform Security component under specific timing or configuration conditions (AC:H). Successful exploitation results in full takeover of the OBIEE application, potentially exposing sensitive business intelligence data and allowing modification or destruction of analytics content. No public exploit code has been identified at time of analysis.